Trojan.W97M.CVE201711882.PVRZY

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It takes advantage of software vulnerabilities to allow a remote user or malware/grayware to download files. As of this writing, the said sites are inaccessible.

Arrival Details

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Download Routine

This Trojan connects to the following website(s) to download and execute a malicious file:

• http://healthcompanion.{BLOCKED}a.com/iphy/doc.exe

It takes advantage of the following software vulnerabilities to allow a remote user or malware/grayware to download files:

• CVE-2017-11882 | Microsoft Office Memory Corruption Vulnerability

It saves the files it downloads using the following names:

• %Application Data%\DownloadData.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, and 8.)

As of this writing, the said sites are inaccessible.